CVE-2024-48938: 
Linux Debian vulnerability analysis and mitigation

A medium severity vulnerability (CVE-2024-48938) was identified in Znuny, affecting versions LTS 6.5.1 through 6.5.10, 7.0.1 through 7.0.16, and all versions of LTS 6.0. The vulnerability was disclosed on October 2, 2024, and involves a Denial of Service (DoS) and Regular Expression Denial of Service (ReDoS) condition that can be triggered via email processing (Znuny Advisory).

The vulnerability occurs when parsing email content containing HTML code copied from Microsoft Word. This parsing process can trigger high CPU usage and block the entire parsing mechanism. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is classified under CWE-1333 (Inefficient Regular Expression Complexity) (NVD).

When exploited, this vulnerability can cause high CPU utilization and effectively block the email parsing process, leading to a denial of service condition. This can significantly impact the system's ability to process incoming emails, potentially affecting business operations that rely on email communication processing (Znuny Advisory).

The vulnerability has been addressed in newer versions of the software. Organizations running affected versions should upgrade to a patched version beyond the affected range (6.5.10 for LTS 6.5.x series or 7.0.16 for 7.0.x series) (Znuny Advisory).